203026 - crash using button onclick() and modifying page dom [@ nsHTMLButtonElement::HandleDOMEvent ]

Status: RESOLVED DUPLICATE of bug 194582

(Core :: DOM: Events, defect)

Description

[Grant Finnemore]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030312

In the attached javascript example, clicking on the "remove input" button
removes the table row in which the buttons are enclosed. Clicking on the "remove
button" button will kill the browser.

Reproducible: Always

Steps to Reproduce:
1. Load included html
2. Click on "Remove Button" button


Actual Results:  
Browser crashed

Expected Results:  
Removed row

Comment 1

[Grant Finnemore]

Attachment: test case for bug

Comment 2

[José Jeria]

Also crashing with 2003042204, Windows 2000.

Comment 3

[Phil Schwartau]

Attachment: Talkback incident TB19421335G

Comment 4

[Phil Schwartau]

---> DOM Events 

Comment 5

[Olivier Cahagne]

same stack, not sure about the testcase as it's more complex but looks like a
dupe of bug 194582.

Comment 6

[Olivier Cahagne]

linux debug build 20030420, same stack as in bug 194582: 

0x40fea055 in nsHTMLButtonElement::HandleDOMEvent (this=0x8275b58,
    aPresContext=0x894a330, aEvent=0xbfffe860, aDOMEvent=0x0, aFlags=1,
    aEventStatus=0xbfffec04) at nsHTMLButtonElement.cpp:488
488         mForm->OnSubmitClickEnd();
(gdb) bt
#0  0x40fea055 in nsHTMLButtonElement::HandleDOMEvent (this=0x8275b58,
    aPresContext=0x894a330, aEvent=0xbfffe860, aDOMEvent=0x0, aFlags=1,
    aEventStatus=0xbfffec04) at nsHTMLButtonElement.cpp:488
#1  0x40e11ddf in PresShell::HandleEventInternal (this=0x8956680,
    aEvent=0xbfffe860, aView=0x0, aFlags=1, aStatus=0xbfffec04)
    at nsPresShell.cpp:6327
#2  0x40e11bbb in PresShell::HandleEventWithTarget (this=0x8956680,
    aEvent=0xbfffe860, aFrame=0x89eb1c0, aContent=0x8275b58, aFlags=1,
    aStatus=0xbfffec04) at nsPresShell.cpp:6289
#3  0x40fbd39f in nsEventStateManager::CheckForAndDispatchClick (
    this=0x86c4d18, aPresContext=0x894a330, aEvent=0xbfffeed0,
    aStatus=0xbfffec04) at nsEventStateManager.cpp:2910
[...]

*** This bug has been marked as a duplicate of 194582 ***